feat(oci_image_index): support annotations attribute

[yeji-poolside]

Adds an annotations attribute to oci_image_index, mirroring the existing one on oci_image. The macro accepts annotations as either an inline dict or a label to a key=value file; the underlying rule takes a file (the macro converts a dict via write_file, same as oci_image). Annotations are merged into the index manifest's top-level .annotations field before its digest is computed, so the wrapper's descriptor still matches the blob. The merge reuses the same jq filter oci_image uses, so behavior is consistent across the two rules.

Fixes #798.

Use case (from #798): GitHub Container Registry, Akuity Kargo, and other consumers look for org.opencontainers.image.source and org.opencontainers.image.revision on the index of multi-arch images to surface commit/repository links in their UIs. Without this attribute, users have to post-process the index outside Bazel.

Example:

  oci_image_index(
      name = "app",
      images = [":app_linux_amd64", ":app_linux_arm64"],
      annotations = {
          "org.opencontainers.image.source": "https://github.com/example/repo",
          "org.opencontainers.image.revision": "abc1234",
      },
  )